Unlike a standard program, add-ons, extenions, and user scripts, a bookmarklet can run only when you click it.
A bookmarklet can not access files on your hard drive.
A bookmarklet can affect only the web site you are viewing at the time you click it.

A bookmarklet is usually written in the programming language called Javascript.
This is the same type of programming used in almost all of the top websites on the Internet.

All of these statements are generalizations only.
Like all software, you should not use bookmarklets from dangerous sources.
Also, you should never use a bookmarklet when you are visiting a site where security is critical, such as your bank's website.